Missing authentication for critical function in TR7 Cyber Defense Inc. WAF-ASP allows authentication abuse. This vulnerability affects WAF-ASP versions from v1.0.324.900 before v1.4.0.117.
An unauthenticated attacker over the network can bypass authentication controls to access and manipulate critical WAF-ASP functions, enabling unauthorized configuration changes, security policy modifications, or other administrative operations.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch available. Update to WAF-ASP v1.4.0.117 or later.
Immediately upgrade TR7 Cyber Defense Inc. WAF-ASP to version 1.4.0.117 or newer. Restrict network access to WAF-ASP administrative interfaces using network segmentation and firewall rules. Monitor WAF-ASP access logs for unauthorized authentication attempts or suspicious administrative activity.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Feedly found the first article mentioning CVE-2026-4767 . See article
NVD published the first details for CVE-2026-4767
A CVSS base score of 9.8 has been assigned.
GitHub Advisories released a security advisory .
[GHSA-6qqj-v86p-pcpj] Missing authentication for critical function vulnerability in TR7 Cyber Defens
Critical Vulnerability CVE-2026-4767 in TR7 Cyber Defense WAF-ASP
CVE-2026-4767 - Improper Access Control in TR7's WAF-ASP CVE ID : CVE-2026-4767 Published : July 2, 2026, 1:12 p.m. | 2 hours ago Description : Missing authentication for critical function vulnerability in TR7 Cyber Defense Inc. WAF-ASP allows Authentication Abuse. Th...
CVE-2026-4767 | TR7 Cyber Defense WAF-ASP prior 1.4.0.117 missing authentication
Collect, analyze, and vulnerability reports faster using AI
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
